Not sure how to handle this. Our current app (.Net MVC) is accessed via companyname.appname.com, authentication is handled via forms (cookie) authentication. Within the app there is a global search box that is quite heavily used, we are looking to split this out into it's own microservice so all calls for search will go to something like search.appname.com instead, therefore lightening the load on the main app.

The question we have is about how best to authenticate the calls to that url. We can't share cookies across sub-domains as all clients have a different sub-domain and the sharing cannot be restricted to a select no. of domains (or not to my knowledge).

Do we return an API token when they first login that we store and use for API calls or is there another way?

1 Answer 1


Cookies on the domain .appname.com should be sent to both companyname.appname.com and search.appname.com so you can potentially use the same cookie.

However, all "cookie authentication" means is that the token is stored in a cookie. If you have "standard out of the box" cookie auth on your .net MVC site you will need to have bother the same setup and share machine keys with your api. Which is not always the best solution.

If you implement oauth and use a json token with claims in a central single sign on auth service you can reuse that token across all your sites and apis. Sending it in a cookie or a header as best fits your application.

Say for example your site is on domain1.com and your search is on domain2.com and your auth is on domain3.com. You can have the website call auth via javascript to get the token. Set that token as a cookie on domain1.com so that you can browse the site AND pass it as a header when you make api calls to the api domain2.com in javascript.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.